topic Re: How do I configure Splunk to prevent 3 separate events from being merged as a single event? in Getting Data In

How do I configure Splunk to prevent 3 separate events from being merged as a single event?

athorat — Mon, 07 Dec 2015 23:53:37 GMT

When I search on one of the indexes, I get the data in a single event.
It should be three separate events. How can we deal with it?

Event returned in Splunk:

maintainCSAAContract,maintainCSAAContract,SOAUSER,,,479244912373535201,0,,9,2015-12-02 23:22:15.35,2015-12-02 23:22:15.709,359,,,,2,89501422,87549234,,,,67,121154630,5849501,,,,,, validateCSAAContractPartyRole,validateCSAAContractPartyRole,SOAUSER,Realtime,,973244912373550901,300,31696,0,2015-12-02 23:22:15.507,2015-12-02 23:22:15.766,259,,,,,,,,,,13,215066973,85403412,,,,,, maintainCSAAContractRoleIdentifier,maintainCSAAContractRoleIdentifier,TestUser,PROFILE_INSERT_UPDATE,,339944912373599301,300,1698,0,2015-12-02 23:22:15.992,2015-12-02 23:22:16.293,301,2,14557745,12844709,,,,,,,38,122412057,20411825,,,,,,

This should be 3 separate events

Event 1:

maintainCSAAContract,maintainCSAAContract,SOAUSER,,,479244912373535201,0,,9,2015-12-02 23:22:15.35,2015-12-02 23:22:15.709,359,,,,2,89501422,87549234,,,,67,121154630,5849501,,,,,,

Event 2:

validateCSAAContractPartyRole,validateCSAAContractPartyRole,SOAUSER,Realtime,,973244912373550901,300,31696,0,2015-12-02 23:22:15.507,2015-12-02 23:22:15.766,259,,,,,,,,,,13,215066973,85403412,,,,,,

Event 3:

maintainCSAAContractRoleIdentifier,maintainCSAAContractRoleIdentifier,TestUser,PROFILE_INSERT_UPDATE,,339944912373599301,300,1698,0,2015-12-02 23:22:15.992,2015-12-02 23:22:16.293,301,2,14557745,12844709,,,,,,,38,122412057,20411825,,,,,,

Re: How do I configure Splunk to prevent 3 separate events from being merged as a single event?

sundareshr — Tue, 08 Dec 2015 01:39:28 GMT

how are the events in the log file? Are these in separate lines? In other words, each event in a separate line? What's in your props.conf

Try adding the following to your props.conf
SHOULD_LINEMERGE = false

Re: How do I configure Splunk to prevent 3 separate events from being merged as a single event?

renjith_nair — Tue, 08 Dec 2015 07:18:35 GMT

use LINE_BREAKER = to break your lines if it does not have default line breaking based on timestamp and new line.

Refer to http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Indexmulti-lineevents for details

Re: How do I configure Splunk to prevent 3 separate events from being merged as a single event?

athorat — Thu, 10 Dec 2015 23:35:42 GMT

Thanks for the suggestion, but that did not work.